CVE-2021-22862: github Improper Authorization

Vulnerability summary

CVE-2021-22862 is a medium (CVSS 6.5) Improper Authorization vulnerability in github. EPSS estimates a 0.84% chance of exploitation in the next 30 days, higher than 57.3% of scored vulnerabilities.

Timeline

1. 03-03-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to disclose Actions secrets for the parent repository of the fork. This vulnerability existed due to a flaw that allowed the base reference of a pull request to be updated to point to an arbitrary SHA or another pull request outside of the fork repository. By establishing this incorrect reference in a PR, the restrictions that limit the Actions secrets sent a workflow from forks could be bypassed. This vulnerability affected GitHub Enterprise Server version 3.0.0, 3.0.0.rc2, and 3.0.0.rc1. This vulnerability was reported via the GitHub Bug Bounty program.

• CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.